fix(machine, ci): the exit gives back what no client can delete, and the leg that leaks is the one that reddens (#521)

[stephrobert]

Closes #521.

The incus-ovn leg of runtime-proof.yml has been red on its doorstep, and
since #585 it is the only cause left on that workflow. Every suite passes —
the three network suites, the three ssh suites, the report, the stop — and then:

a previous run left 0 machine(s) and 2 network(s) on this host.
  network feint-uplink, network fnt-default,
  rule-set exo-11e594f4819, rule-set scw-aa3f1f56ec5

There is no previous run. It is a fresh runner, and the suites of the same job
left those objects. The doorstep of the next step found them and blamed
somebody else.

Who creates each object, and why nothing removed it

Measured by replaying the leg on the station, reading the host at every frontier.
The reproduction is byte-for-byte the CI failure — same four objects, same
counts, only the Scaleway digest differs because that one is minted per run.

object	who makes it	why nothing removed it
fnt-default	the Outscale ssh suite — its Vm lives outside a Net, so it has no attachment of its own and boots on DefaultMachineNetwork	no emulated resource owns it, so no client delete can reach it
feint-uplink	the driver, when fnt-default is created under OVN	already released since #521 — it stayed because fnt-default still drew from it (used_by=1, read on the host)
scw-<digest>	the Scaleway ssh suite — the project's default security group, permissive, attached to nothing	the API refuses to delete a project default group, and the id is minted per run: one host ACL accumulates per session
exo-<digest>	the Exoscale ssh suite — the account's default group, DefaultIngress: drop, attached while the instance lives	same refusal; fixed id, so it survives rather than piles up

No osc- rule set appears, and that is not luck: an Outscale Vm outside a Net
wears no security group.

The "shared session resource" hypothesis was measured and rejected

The brief offered it: perhaps feint-uplink and fnt-default are session
resources the gate is wrong to count.

They are shared within one emulator — but the doorstep is asked when that
emulator is gone, so the session is over and the gate is right. Exempting them
would blind it to the leftovers of a killed run, which is exactly what
crash.sh asserts must survive a SIGKILL and be named.

So the fix belongs on the emulator side, not the gate's, and that is where it
went.

No feint clean was added anywhere

That shortcut would have made the night pass and removed the only thing that
detects a real leak. The release is targeted per object, and it asks both
questions before any destructive command — is it ours (the label, and the
description EnsureFirewall writes) and is anything still drawing from it
(used_by, read first rather than the delete being attempted blind).

A feint stop without --cleanup therefore still keeps the firewall on the
machines it deliberately leaves running.

machine.UplinkReleaser becomes machine.PlumbingReleaser; ReleasePlumbing
gives back rule sets → default network → uplink, in the only order the runtime
accepts — reversed, every step answers "in use", which is the measured state.

The gate, at the right place, saying the right thing

feint clean --check --closing and guard.sh leftovers-after: the same refusal,
with the culprit named as this run. mise.toml and leg.sh move to it too —
they carried #521's form but the doorstep's sentence. runtime-proof.yml gains
one step, What this leg left on the host, after its own stop, and deliberately
not if: always(): a leg that already died left wreckage, not a leak. No job
renamed.

And the doorstep now names the rule sets it does not refuse on, with the
reason. Until now they were printed only when some other object had already
made it refuse — so the artefact that accumulates once per session was invisible
exactly where it was all that was left.

An instrument that lied, found on the way

The ledger's attribution column recorded networks as name-prefix:fnt-, while
Survey selects them by label — and the first network the failing leg named,
feint-uplink, carries no such prefix. Corrected, with a test; the old test
asserted the lie and was rewritten.

Reproduction

BEFORE  ssh suites (3× exit 0) → feint stop → doorstep
        exit 1: feint-uplink (used_by=1), fnt-default (used_by=0),
                scw-45e6b24f03f, exo-11e594f4819

AFTER   same sequence → the exit logs
        "released the plumbing this run held: scw-…, exo-…, fnt-default, feint-uplink"
        host: no network of ours, no rule set of ours, the operator's acltest untouched
        closing doorstep exit 0, gate doorstep exit 0

Falsification

22 mutations of a-run-ends-where-it-could-start.json — 15 new, one per
guard added — plus 3 retargeted in run-leaves-nothing.json and
unkillable-dhcp-orphan.json. Every one red.

Replayed by hand against a warm build cache: mise run falsify copies the
repository and recompiles the whole module per mutation, which is minutes for
internal/core/machine. All are declared in the specs so falsify:all replays
them nightly; falsify:lint is green.

Gates

prepush ✅ · mise run conformance ✅ (267 s) · conformance:leg -- probe ✅ ·
-- fields ✅ · conformance:environment ✅ · the full ssh-then-doorstep
sequence on the station ✅.

What was not obtained

• conformance:leg -- runtime is red on this station, twice, at the Outscale
  "two Nets, a machine in each" step: feint-osc-… does not carry 10.184.1.4.
  Not assumed to be this branch's: 2f90c42 was exported to a scratch tree,
  built, and the same two suites run in the same order — identical failure,
  same address. Pre-existing and station-specific (CI's run 33182105527 passed
  that suite). It deserves its own issue: the wait is wait_until 24, twenty-four
  seconds for a machine to carry its address under OVN.
• feint images cannot build on this station — the default Incus profile
  carries no NIC, so fix(machine, ci): the build instance is waited for on the address its next command needs, and the runner is proved innocent before the build blames it (#583) #585's new refusal fires. That is feint images build silently depends on the operator's Incus default profile, and a station where feint has run may not have a NIC there #584. A NIC was added for
  the build and removed again, profile verified restored.
• conformance:witness was not run end to end; its doorstep was reproduced
  exactly, which is the line that failed.
• The stacks job's own closing state was not touched.

Where testplan was wrong, on the load-bearing point

It named probe, fields, runtime, environment and 27 falsify specs — and
not the population the defect lives in. The ssh suites are in no leg, and
-- runtime runs the network suites, which end on their own feint clean and
therefore sweep the leak away before any closing doorstep sees it.

Taken as a ceiling, everything would have been green and the leg would still
fail. Floor, not ceiling — the fifth time this week.